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Abstract 



CO 



In this work, a class of information theoretic secrecy problems is addressed where the eavesdropper 
channel states are completely unknown to the legitimate parties. In particular, MIMO wiretap channel 
models are considered where the channel of the eavesdropper is arbitrarily varying over time. Assuming 
that the number of antennas of the eavesdropper is limited, the secrecy rate of the MIMO wiretap channel 
in the sense of strong secrecy is derived, and shown to match with the converse in secure degrees of 
freedom. It is proved that there exists a universal coding scheme that secures the confidential message 
against any sequence of channel states experienced by the eavesdropper. This yields the conclusion that 
secure communication is possible regardless of the location or channel states of (potentially infinite 
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number of) eavesdroppers. Additionally, it is observed that, the present setting renders the secrecy 
capacity problems for multi-terminal wiretap-type channels more tractable as compared the case with 



full or partial knowledge of eavesdropper channel states. To demonstrate this observation, secure degrees 
of freedom regions are derived for the Gaussian MIMO multiple access wiretap channel (MIMO MAC- 
WT) and the Gaussian MIMO broadcast wiretap channel (MIMO BC-WT) where the transmitter(s) and 
the intended receiver(s) have the same number of antennas. 

Index terms: Information theoretic secrecy, MIMO wiretap channel, MIMO MAC wiretap channel, MIMO BC 
wiretap channel, strong secrecy, eavesdroppers with unknown location. 
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I. Introduction 

Information theoretic secrecy dates back to the seminal work by Shannon (T), where it was 
shown that if the eavesdropper had perfect knowledge of the signals sent by the transmitter and 
had unbounded computational power, to achieve perfect secrecy, the transmitter and the receiver 
would have to share a key whose rate equals that of the data. 

Wyner, in 0, found that Shannon's result was overly pessimistic, and showed that for the 
wiretap channel, where the eavesdropper had a noisy observation of the signals sent by the 
transmitter, a positive rate could be supported for transmitting confidential messages without 
requiring the communicating parties to share a key. The model was generalized by Csiszar and 
Korner in 0. 

The wiretap channel model in [El-El has inspired considerable effort toward identifying 
secure communication limits of various channel models, e.g. ll5l- lfT6l . In these works, it is 
assumed that the transmitter(s) has (have) perfect knowledge of the eavesdropper channel states, 
which may be difficult to obtain in a practical system, since the eavesdropper is by nature a 
passive entity. To resolve this issue, recent works attempt to relax this condition by assuming the 
transmitter only has partial knowledge about the channel states of the eavesdropper. Notably, 
this line of work includes the compound setting, where the eavesdropper channel can only 
be taken from & finite selection |[T7l - ll2~0l . and the fading channel, where the transmitter only 
knows the distribution of the eavesdropper channel [|2TI . These each call for different types of 
codebook design. For example, in [fT71 - [[T9l , the coding scheme depends on the possible channel 
gains of the eavesdropper included in the finite set. For the fading setting [21 J, the duration of 
communication needs to be able to accommodate a sufficient number of channel uses to ensure 
that the ergodicity assumption is valid. In addition, the rate of the codebook depends on the fading 
parameter of the eavesdropper, e.g., the variance of the Rayleigh distribution, and thus needs to 
be acquired, which may be difficult to do with a passive malicious entity. Given the absence of a 
robustness analysis toward understanding how sensitive the achievable secrecy rate is to errors in 
the aforementioned modeling parameters in [fT71 - [[T9l . (|2T|. it is difficult to ascertain how close 
these can model a realistic secure system design based on information theoretic guarantees. 

The case where the eavesdropper's location is not perfectly known was also considered in 
the context of network coding. In ||22l. the eavesdropper is assumed to monitor no more than 
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K edges in a network, while the locations of these edges can be arbitrary. The code designer 
uses the fact that there are more than K routes connecting the sender and the receiver of the 
confidential message, while the eavesdropper can not monitor all routes. The simple, yet powerful 
insight offered by ||22| on the merit of utilizing the advantage enjoyed by the legitimate nodes 
via multiple routes, can be brought into the wireless setting by utilizing multiple antennas. 
Specifically, if the intended receiver has more antennas than the eavesdropper, then even though 
the eavesdropper can be anywhere, i.e., experience any channel state, it can not monitor all 
antennas of the receiver. 

Inspired by this observation, in this work, we study the MIMO wiretap channel, where the 
number of antennas at the eavesdropper is limited. The channel state sequence of the eavesdropper 
is assumed to be independent from the input and output of the wiretap channel. Conditioned on 
any given sequence of channel states, we assume that the eavesdropper channel is memoryless. 
No restriction is placed on the statistics of the channel model observed by the eavesdropper. 
That is, the eavesdropper's channel is totally unknown to the legitimate parties and can vary 
arbitrarily over time. 

The main contribution of this work is to prove the existence of a universal coding scheme 
that secures the confidential message against any sequence of eavesdropper channel states for 
the MIMO wiretap setting described above. This means the coding scheme could withstand the 
presence of infinitely many eavesdroppers as long as they do not collude. The universal nature 
of the coding scheme is what sets this work apart from the previous work that considered a 
similar setting with fading ll23l . Additionally, unlike |24| which considered the discrete arbitrarily 
varying wiretap channel, this work considers a Gaussian setting which does not lend itself to a 
direct extension from its discrete counterpart. 

The achievable rates we prove in this work satisfy strong secrecy requirements ll25l . It is well 
accepted that weak secrecy is insufficient for practice Il25ll - ll27l . However, it is often argued that 
strong secrecy can be obtained from weak secrecy through privacy amplification, as shown in 
IJ25l . We shall show that, in the setting considered in this paper, this is not the case. Therefore, 
not only we provide the proof of weak secrecy, but a direct proof of strong secrecy as well, 
which yields the same achievable rate as its weak counterpart. 

The achieved rate derived in this work is tight in terms of secure degrees of freedom (s.d.o.f.), 
which is a high SNR characteristic of the secrecy capacity. 
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We also extend our results to a MIMO MAC wiretap channel (MIMO MAC-WT) and a 
MIMO Broadcast wiretap channel (MIMO BC-WT), for the case where legitimate transmitter(s) 
and receiver(s) have the same number of antennas, and identify their secure degrees of freedom 
region. It is interesting to note that, in the seemingly simpler setting where the eavesdropper's 
channel is perfectly known to the legitimate parties, the secure degrees of freedom region for 
the MIMO MAC-WT channel remains an open problem |fl9ll, [|28l, ll29l 

The remainder of the paper is organized as follows. The system models are introduced in 
Section [III In Section Unl we state the main results, which are proved in Sections [IV] and [V] 
Section [VI] presents a discussion on strong secrecy as well as a detailed comparison to related 
work. Section IVIII concludes the paper. 

II. System Models 

A. The (N T , N R , N E ) MIMO Wiretap Channel 

The channel from the transmitter to the intended receiver, i.e., the main channel, is assumed 
to be static. Let A(i) denote the value of the signal A during the ith channel use. The input and 
output of the main channel during the ith channel use are related as: 

YjVjjXlW = HN R xN T ^-N T xl(i) + Ztv h xi(z) (1) 

where the subscripts denote the dimension of each term. H denotes the N R x N T channel matrix 
with complex entries^. It is assumed that H has full rank. Z is a Nr x 1 vector representing the 
additive noise. Z is composed of independent rotationally invariant complex Gaussian random 
variables, each with zero mean and unit variance. X and Y are the transmitted and received 
signals respectively. 

The channel from the transmitter to the eavesdropper, i.e., the eavesdropper channel, is an 
arbitrarily varying channel. It can be expressed as: 

Yjv E xiOO = H NExNT (i)X NT><1 (i) (2) 

where Y(i) denotes the signals received by the eavesdropper during the ith channel use. flN EX N T (i) 
is the channel state matrix for the eavesdropper channel during the ith channel use. We use H" 

'Since we assume that the main channel is static, H remains fixed for all channel uses. 
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to denote H(l), ...,H(n). H n is not known at the legitimate parties. We also assume H n is 
independent from X™. 

Note that we assume the eavesdropper's channel is noiseless. This is obviously a worst case 
assumption, and if the eavesdropper's signals are corrupted by additive noise, they can always 
be considered as a degraded version of the signals received by the eavesdropper considered in 
this work. 

Let W denote the confidential message transmitted to the intended receiver, over n channel 
uses using X". In addition, we assume that there is a local random source M which is only 
known to the transmitter. X™ is computed by the transmitter from W and M using the following 
encoding function f n : 

X n = f n (W,M) (3) 

Note that /„ does not depend on H, since the transmitter does not know the channel state of 

the eavesdropper. 

J] 
We represent X n as a Nt x n matrix, with the average power constraint] 

lim -trace(X n (X n )^) < P. (4) 

n— >oo 77, 

Let W denote the decoder output of the intended receiver from Y n . Then we require 

lim Pr(W ^ W) = (5) 

n— >oo 

for reliable communication. Additionally, we require the following strong secrecy constraint [|25l 
to hold for any distribution of H". 

lim I(W; Y", H n ) = (6) 

n— >oo 

When designing the encoder f n , we need a uniform bound on I(W; Y n , H n ) over all possible 
distributions of eavesdropper channel state sequences for a given n, which will determine the 
minimal codeword length required to achieve a certain level of secrecy. Hence, it is important 
for the convergence in © to be uniform for all possible statistics of the eavesdropper channel 
state sequence. 

2 trace denotes the sum of the diagonal elements of a square matrix. 
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Fig. 1. The MIMO Wiretap Channel. 



Ne antennas 



Since H" is independent from X n , © can be written as: 

lim I(W;Y n \H n ) = (7) 

n—Hx 

On the other hand, since we do not want the secrecy constraint to rely on the distribution of 
H n , we require that for any given sequence h n , 

lim I{W; Y n |H" = h n ) = 0. (8) 

In the sequel, to simplify the notation, we use a scalar 7 to index the sequence h n and use Y™ 
to represent the random variable Y n when H n equals the sequence h n indexed by 7. Then ([8]) 
can be written as: 

lim I(W; TO = 0, V 7 (9) 

n— >-oo ' 

Secrecy rate R s 

R s = lim -H(W) (10) 

n— >oo fl 

for the MIMO wiretap channel is said to be achievable if for each n there exists & fixed encoding 
function f n as defined by ©, such that for any given the eavesdropper channel H, ©, ©, © 
and (flOl ) holds for R s . The supremum of all possible values for R s is the secrecy capacity of 
this channel model. 

The high SNR behavior of the secrecy rate is characterized by the secure degrees of freedom 
defined as: 

R s 



s.d.o.f. = lim sup 

P^oo log 2 [P) 



(ID 
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Fig. 2. The (Nt,Nt,Nt,Ne) MIMO MAC wiretap channel where legitimate nodes have Nt = 2 antennas each, and the 
eavesdropper has Ne = 1 antenna. 



We use the term the secure degrees of freedom of a channel to represent the largest possible 
value of secure degrees of freedom. 



B. The (N T , N t , N t , N e ) MIMO MAC Wiretap Channel 

We also consider the MIMO MAC wiretap channel, an example of which is shown in Fig- 
ure |2l We assume each transmitter has N T antennas. The receiver also has N T antennas. The 
eavesdropper has Ne antennas. During the zth channel use, the channel is defined as: 



Y(*) = ^H fc X fc (2) + Z( 
fe=i 

2 

Y(z) = J]H fc (i)X fc (z) 



(12) 



(13) 



fe=i 



where H&, k — 1, 2 and Hfc(i), k — 1, 2 are channel matrices. Z is the additive Gaussian noise 
observed by the intended receiver, which has the same distribution as the Z in (0Q). Hfc(z'), k = 1,2 
are not known to the legitimate parties. The sequence {Hfc(i),A; = 1,2} are independent from 
the value of X&, fe = 1, 2 over n channel uses. H^, k — 1, 2 are known by both the legitimate 
parties an J the eavesdropper(s). 

User k wishes to transmit a confidential message Wk to the receiver over n channel uses, while 
both messages must be kept confidential from the eavesdropper. We use 7 to index a specific 
sequence of {H. k (i), k = 1,2} over n channel uses and use Y" to represent the corresponding 
channel outputs for Y n . The secrecy constraint is: 



limJ Wi,W 2 ;Y? =0, V 7 



(14) 
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Again, we stress that the convergence of the limit in (fT4l) must be uniform over all possible 
sequences of the eavesdropper channel states. 

The average power constraints for the two users are given by 

lim -trace(X£(X£) H ) < P k , k = 1, 2 (15) 

n— >oo Tl 

The secrecy rate for k, R s ,k, is defined as 

R s . k = lim -H(W k ),k = 1,2 (16) 

n— >oo TL 



such that W k can be reliably decoded by the receiver, and (1141) and (1151) are satisfied. 

We define the secure degrees of freedom region similar to 11301 : We assume P k — P, k — 1, 2. 
The secure degrees of freedom region is defined as: 

{(di,d 2 ) : 4 = limsup-^%,fc = 1,2} (17) 

P^oo ^g 2 P 

C. The (N T , N T , N T , N E ) MIMO Broadcast Wiretap Channel 

Similarly, we can consider a MIMO Broadcast (BC) wiretap channel shown in Figure |3j We 
assume that the transmitter has Nt antennas, as well as each receiver. The eavesdropper has Ne 
antennas. During the zth channel use, the channel is defined as: 

Y fc (z)=H fc X(z) + Z fc (i),A; = l,2 (18) 

Y(i) = H(i)X(i) (19) 

where H k ,k = 1,2 and H(i) are the channel matrices. Z k ,k = 1,2 is the additive Gaussian 
noise observed by the intended receivers, which has the same distribution as the Z in (OQ). H(i) 
is unknown to the legitimate parties. H^, k — 1, 2 are known by both the legitimate parties and 
the eavesdropper(s). 

Each receiver k receives a confidential message W k from the transmitter over n channel uses, 
while both messages must be kept confidential from the eavesdropper. The secrecy constraint is: 

lim I (w u W 2 ;yA = 0, V 7 (20) 

where, as before, 7 is used to index the eavesdropper channel state sequence. Again the conver- 
gence of the limit in (l20l) must be uniform over all possible sequences of eavesdropper channel 
states. 
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Fig. 3. The (Nt , Nt , Nt , Ne) MIMO BC Wiretap Channel where legitimate nodes have Nt — 2 antennas each, and the 
eavesdropper has Ne = 1 antenna. 



The average power constraint for the transmitter is given by 



lim -trace(X n (X n n <P 

n—t-oo fl 



(21) 



The secrecy rate R s ,k,k = 1,2 is defined as in (TT6l) . The secure degrees of freedom region 
(di,d,2) is defined as in (flTl) . 



III. Main Results 

The main results of this work are the following theorems: 

Theorem 1: Let Nt,r = min{7Vr, Nr}. Let Sj be the Nt,r singular values of H. Define P as 



P = max{P - N t ,r, 0} 
Define C(x) as |log 2 (l + x). Then any secrecy rate R s that satisfies 



(22) 



< i? s < max 




s?P 



N E C(P),0 



(23) 



^ + 1)N T>R , 

is achievable for the MIMO-wiretap channel described in Section III-AI 
Theorem \\\ is proved in Section [TV] 

In Section IIV-GI we show that the achievable secrecy rate given by Theorem [Q matches the 
converse in terms of secure degrees of freedom. Hence we have the following corollary. 
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Corollary 1: If H has rank mm{N T , N R }, then the s.d.o.f. of the MIMO-wiretap channel 
described in Section III-AI is 



max{min{iV T , N R } - N E , 0} 



(24) 



The achievable secrecy rate given by Theorem \T\ can be easily extended to the MIMO 
(Nt, N t , N t , N e ) MAC wiretap channel and the MIMO (Nt, N T , N T , N E ) BC wiretap channel 
using time sharing. Let a be the time sharing parameter, and a = 1 — a. Let [x] + equal to x if 
x > and if x < 0. Define P^ a , k = 1, 2 as: 



k,a 



-N 7 



a 



1,2 



(25) 



Let "co" denote the convex hull operation, and Sk,u k = 1,2 denote the N T singular values of 
H fc . Then, for the MIMO (Nt, N t , Nt, Ne) MAC wiretap channel, the achievable secrecy rate 
region is given by: 

(R S> 1, R S ,2) '■ 



CO 



U 



N T 



shPi,« 



< R sA < a[gC ((igrwj - N E C (P 1>tt )]- 



(26) 



For the MEMO (Nt, Nt,Nt, N E ) BC wiretap channel, the achievable secrecy rate region is 
given by: 

(0,0), 



co < 



(Rs,l, Rs,2) '■ 

N T 

([EC 



t=i 



,2 p 
1,» 



(1+sIANt 



-N e C(P)]+,0), 



N t 



(27) 



(o.Ec(^45^)-^c(P)]+) 

\ i=l ■ / 

In Section |V] we show that these achievable regions match their converse in terms of secure 
degrees of freedom region. Hence we have the following two theorems: 

Theorem 2: If H&, k — 1, 2 has full rank, the secure degrees of freedom region of the MIMO 
MAC wiretap channel in Figure [2] is given by: 

d l + d 2 < max{iV r - N E , 0} (28) 

(29) 



di > 0, i = 1, 2 
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Theorem 3: If Hk,k =1,2 has full rank, the s.d.o.f. of the secrecy capacity region of the 
MIMO BC wiretap channel in Figure [3] is given by: 

d 1 + d 2 < msx{N T - N E , 0} (30) 

di > 0, i = l,2 (31) 

Remark 1: When the eavesdropper's channel state is fixed and known by the transmitters, 
the s.d.o.f. region for the MIMO MAC wiretap channel is still an open problem. When the 
eavesdropper's channel state can take more than one possible value from a finite set and the set 
is known by the transmitters, the s.d.o.f. region for the MEMO BC wiretap channel is also open. 
On the other hand if the eavesdropper's channel is arbitrarily varying and is only known by the 
eavesdropper, and all legitimate nodes have the same number of antennas, the s.d.o.f. capacity 
region of both problems are found in this paper. □ 

IV. The MIMO Wiretap Channel 

In this section, we present our detailed results on the MIMO wiretap channel. The section is 
divided into a number of subsections for the reader's convenience. We first present the notation 
used extensively in the sequel. The next several sections lead to the achievable rate provided by 
TheoremQ] Section lTV-Bl provides the channel transformation and signaling scheme. Section lTV-CI 
presents the codebook construction. Section IIV-DI presents the achievability proof for the static 
eavesdropper channel. Building on this proof, Section IIV-EI presents the achievable secrecy rate 
for the arbitrarily varying eavesdropper channel. Both of these rates are proved with strong 
secrecy. The achievable rate with weak secrecy is derived for completeness as well as maintaining 
consistency with most of current literature in information theoretic secrecy, e.g., 0, JH. A 
diagram summarizing the steps leading to the achievability proof along with key methodologies 
is provided in Figure HI Finally, in Section IIV-GI we present the converse to establish the secure 
degrees of freedom result in Corollary [Q 

A. Notation 

We use pw( w ) to denote the probability mass function (p.m.f.) of a random variable W 
evaluated at w. / 7i a(o) denotes the probability density function (p.d.f.) of a random variable A 
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Fig. 4. Organization of the proof for Theorem Q] 



at value a with parameter 7. f^ : A\B( a \b) denotes the conditional p.d.f. of a random variable A 
conditioned on a random variable B when A = a, B = b with parameter 7. 

For a vector x n , we let ||x n || denote its L 2 -norm. For a matrix A, we let ||A|| 2 denote the 
sum of the L 2 -norm squared of all the row vectors of A. Eb[A] denotes the expectation of A 
averaged over B. 

We define 



A n _ B n c n 

as the row concatenation of the following matrices: 

A(i)-B(»)C(i), \<i<n 
and 

B n C n 
as the row concatenation of the following matrices: 

B(i)C(i), \<i<n 



(32) 



(33) 



(34) 



(35) 



B. Channel Model Transformation 

Consider a general channel matrix H. We can perform singular value decomposition (SVD) on 
H and canceling the right and left unitary matrices of its SVD decomposition at the transmitter 
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and intended receiver respectively. After this cancellation, if N T > N R , the main channel is 
equivalent to a MIMO channel whose channel state matrix is [D NrxNr , On r x(n t -n r )], where D 
is a diagonal matrix composed of singular values of H. In this case, we simply use the first N R 
antennas at the transmitter only in this equivalent channel when designing the achievable scheme. 
The remaining N T — N R antennas transmit signals of value 0. If N T < N R , the main channel is 
then equivalent to a MIMO link whose channel state matrix is [Dtv tX tv t , NtX (n r -n t )] t , where 
( ) T means transpose operation. In this case, we simply discard the signals observed at the last 
N R — N T antennas at the receiver in this equivalent channel when designing the achievable 
scheme. In both cases, from the perspective of designing the achievable scheme, the resulting 
main channel is equivalent to a MEMO link where the transmitter and the receiver both have 
mm{N T , N R } antennas and the channel matrix is diagonal. Thus, without loss of generality, we 
assume Nt = N R and H is a diagonal matrix. 

We next observe that in order to prove Theorem[Q we only need to consider Ne < min{iYY, N R }. 
When Ne > mm{N T , N R }, the achievable secrecy rate in Theorem [Q is zero, by virtue of the 
maximum of the two terms on the right hand side of (1231) being zero. 

Since Ne < min{iYY, N R }, H(i) has the following form of SVD decomposition: 

H(i) = [lN E xN E ,ON E x(N T -N E )]TJ(i) (36) 

where U(z) is a N T x Nt unitary matrix. I is an identity matrix. This can be achieved by canceling 
the left unitary matrix of the SVD decomposition of H(i) and normalizing the singular value at 
the eavesdropper. Note that the transmitter does not know U(i). 

Remark 2: Note that if H(i)(U(i)) -1 has all zero rows, we can alter appropriate entries to be 
Is so that the resulting channel matrix has the form in (l36l) . The signals received by the original 
eavesdropper is always degraded compared to the signals received by the eavesdropper after this 
modification. Hence, it is sufficient to consider the eavesdroppers with H(i) in the form given 
by (EU). □ 

Following IJ23l . we introduce artificial noise at the transmitter. Thus, we have 

X(i) = X(z) + N(i) (37) 

where N is the Nt x 1 artificial noise vector consisting of independent rotationally invariant 
complex Gaussian random variables with zero mean and unit variance. Coding is over X. 
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Define N and N(z) as 

N(i) = HN(i) (38) 

N(i) = H(i)N(z) (39) 

Viewing X as the input to the channel, the channel model can be expressed as: 

Y(z) = HX(z) + N(i) + Z(i) (40) 

Y(i) = H(z)X(i) + N(z) (41) 

From ( |36l) and (1391 ), we observe that N has zero mean and is Gaussian distributed. The 
covariance matrix of N is 

E[H(t)N(t)(N(t)) H (H(0) H ] (42) 

=H(z)E[N(z)(N(z))"](H(z))" (43) 

=H(z)(H(i)) H (44) 

=IjV B xJV B (45) 

C. Codebook Construction 

The codebook ensemble we use is constructed as follows: 

Recall that P was defined in (l22l) . We choose the input distribution for X, Qx(x), as 
rotationally invariant zero mean complex Gaussian with covariance matrix ( ^ )Tv t xjv t - 

The codebook ensemble is composed of the codebooks constructed as described in lf3~Tl Section 
7.3]. In the context of this work, this means defining the n-letter distribution Q^ n (x n ) as follows: 
Let Xi denote the ith component of x n . Q-^„{x n ) is given by: 



Q x „ (x n ) = y£ p <p (x n ) J] Q x (a?0 (46) 

where 

1, if i ||x n || 2 <P 
p(x n ) = { -II II - (47) 

0, otherwise 

/n 
tp(x n )J[Qx(xi)dx n (48) 
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Note that < \x nfip < 1, and for a given e P > 0, we have there exists an a(e P ) > 0, such that 
m (B2)] 

1 - Vn,s P < e~ na ( £p) (49) 

lim a(e P ) = (50) 

Ep^O 

Any codebook in the ensemble is constructed by sampling 2 nR sequences from the distribution 
<5x« in an independent and identically distributed (i.i.d.) fashion. For the strong secrecy proof, 
R is chosen as 

R = I(X;Y)-5' (51) 

The mutual information in (ISTT) is evaluated when X has distribution Q^. 5' is a positive constant 
that can be arbitrarily small. 

Each time we sample a codeword, we label it with (i,j). Define Ni and Nj as the range of i 
and j. They are given by: 

Ni = 2»(«- J (*i*)-^) (52) 

Nj = 2 n ( 7 ( 5t ;Y)+«5„) (53) 

{S n } is a positive sequence whose details will be specified later. Again the mutual information 
in (|53l ) is evaluated when X has distribution Q^. Note that we drop the subscript 7 in this 
expression since the value of the mutual information does not depend on 7 when X has the 
distribution Q^. 

The label i takes values from 1, ..., Ni. j takes values from l,...,Nj. The initial value for i 
and j are both 1. After we label a codeword, if j < Nj, then we increase j by one. Otherwise, 
we increase % by one and reset j to 1. 

Let C denote a codebook in the codebook ensemble {C}. Let xfj denote the codeword in the 
codebook C that is labeled with (i,j). 

As in ll3Tll . for a given codebook C, the intended receiver uses a maximum likelihood decoder: 
Upon receiving Y n = y n , the decoder i/Jc(y n ) is given by 

V> c (y n ) = arg max ||y n -H n x n || (54) 
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The probability of decoding error for each codeword, and the average probability of decoding 
error for each codebook and the codebook ensembles are defined as: 

Ac,m = Pr (ifc(Y») + (i : j)\X n = aft) (55) 

VE^m (56) 



Xc= N<N. 






A = E c [A c ] (57) 

We next present the strong secrecy rate when the eavesdropper's channel is static. 

D. Static Eavesdropper Channel 

For a given codebook C, the encoder f n>c used by the transmitter is described as follows: Let 
the confidential message W be uniformly distributed over the set of {i}. Given W = i, f Hj c 
selects a codeword from all the codewords with label i in codebook C according to a uniform 
distribution. With this encoder, we observe that (i,j) has a uniform distribution. 

Let X.q denote X n when it is sampled in an i.i.d. fashion from the input distribution Q-^(x) 
instead of the codebook. Let Xy denote X n when it is sampled in an i.i.d. fashion from the 
n-letter truncated Gaussian input distribution Q-^ n instead of the codebook. 

Let Yq, Yj., Yg denote Y n when X n is Xg., X^ or uniformly distributed over the codebook 
C respectively. 

Let 7 index (a sequence of) the eavesdropper channel states over n channel uses: H 7 (l), ..., H 7 (n) 
We use d lt c to denote the variational distance between two distribution pwf 1 y« and pwf^ Y n \w> 
which is defined as: 

d-yfi = d \Pwf^Y2,Pwf y> Y^\wJ (58) 

= J2 [ \Pw H / 7iY „ (z n ) - Pw (w) / 7iY „ |Ty (z n \w) \dz n (59) 

= ^2pw M I l/ 7 , Y n (z n ) ~ f^w (z n \w) \dz n (60) 

The proof of achievability we present can be outlined in four steps: 

1) As in [|27l . Il33l . we first prove for any eavesdropper channel state value indexed by 7, d 7j c 
averaged over an ensemble of wiretap codebooks decreases uniformly and exponentially 
fast with respect to the code length n using the information spectrum method from ll34ll . 
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2) We then quantize the channel states and construct a finite subset of values of the eaves- 
dropper channel state. We show that for this subset, there must exist a good codebook that 
retains the property of the codebook ensemble that d 7j c is small. 

3) We show that when the eavesdropper channel state is not in the finite subset, the resulting 
variational distance can be approximated by the variational distance when eavesdropper 
channel state sequence is in the finite set and hence is also small. This is the approximation 
argument from 11351 . 

4) Building on [3]), we prove that the secrecy constraint is satisfied |[33l . and hence the 
codebook secures the message for all possible values of eavesdropper channel states. 

We start the proof with the following lemma: 

Lemma 1: lT2"7l Appendix II, Section D] For a fixed codebook in the ensemble, we have: 

d lfi <2J2pw(w) f |/ 7 ,y ? (^ n ) " / 7 ,Y«|iy (*» \dz n (61) 

For each integral in the sum in (loTT) . we can write 

J\f,,Yi(z n )-f\,YZ\w(z n H\dz n (62) 

< / l/ 7l *s (*") ~ Uyz\w (*» W n + J I/ 7 ,y 3 CO - / 7 , Y? (*") \dz n (63) 

For the second term in (1631) . we have the following lemma: 

Lemma 2: For sufficiently large n, such that 1/2 > e ~ na ( ep \ we have: 

l/ 7 ,*s (^) - / t ,y» (z n ) \dz n < te~ na{£p) (64) 



where a{ep) is the positive exponent defined in (|49l) . 

Proof: The proof is given in Appendix El ■ 

We then can bound the second term in (1631) using Lemma [2l We next bound the first term in 
(l63l) . averaged over W. 

As in E71 Appendix II, Section D], we can use the symmetry property of the random codebook 
ensemble and write: 



E, 



-Er 



^PW{W) / |/ 7] Yg (Z n ) - / 7) y»| W (Z n \w) \dz T 
w J 

f\f^ G {z n )-f^ c \w^)\dz n 



(65) 
(66) 
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See Appendix |B] for steps to arrive at (|66l) from (|65l) . 
For (|66l) . we have the following lemma: 
Lemma 3: |[34l Lemma 5] For a fixed codebook in the ensemble, we have: 



IA,Y» CO - Ly,\w (*"|1) l^ n < r— - A*» + 2Pr 



log 2 e 



log; 



/7,Y2|W ( *cU 



■'T.Yg I 



> Atn 



(67) 



Let / 7 y|x denote the conditional p.d.f. implied by the channel matrix H 7 . Define information 



density fl34J, 2 7)Xs y s (X n ,Y n ), as 



j - - | X™ Y n 
S,XgYg l^ > J 



II / 7 ,Y|X ( Y il X 



log; 



4 = 1 



/ 7 ,YR ( Y ' 



(68) 



Remark 3: Note that the subscript of L x ™y™ (X™, Y n ] simply indicates the p.d.f.s we use 
to compute the information spectrum, which are / 7Y ix an d / 7 y" i n m is case - The arguments 



of ? 7iX "Y™ (X n , Y n ), X™ and Y n , can have a different p.d.f. than the one indicated by the 



subscript of Vxgvg ( X n , Yn ) • D 

Lemma 4: For any positive /i n , such that, 



we have: 



r n = (2"» - fj£ p ) /2 > 



E,- 



Pr 



log; 



•/7,Y5|W I Y cl-1 



/. 



7,Yg 



> /in 



< 



/vL{ pr 



?? 



J 7,XgY G 



L G' X G 



-L *»*« ( X£, Y£ ) > / ( X G ; Y G ) + 5 n + - log, r, 



1 



2 'n 



+ 



Pr 



/?. 



SsXgYg I ^ V G' - 1 G 



„ Y „ X G ,Y G >J X G ;Y G +5, 



+ 



^ IPr 



is,x S v 3 (xS,Y 5 )>/(x ;Y ) + | 



I Q—nSn/2 \ | 



(69) 



(70) 



(71) 



Remark 4: The proof of Lemma |4] is adapted from ||34l Proof of Theorem 4]. The difference is 
that, [34, Proof of Theorem 4] would require the expectation to be taken over an ensemble whose 
codewords are sampled in an i.i.d. fashion from a Gaussian distribution, since (|7TT) is evaluated 
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for this distribution. In Lemma H the expectation is over the ensemble whose codewords are 
sampled from Q^ n , which is close to but not equal to a Gaussian distribution. This difference 
leads to the term fj,~\ m front of the upper bound given by (|7TT) . □ 

Proof: The proof is provided in Appendix O ■ 

Lemma 5: For a given e > 0, if for all n, 8 n > e, then there exists a constant a'(e) > 0, such 
that 



Pr 



^7,*S*3 ( 



<e 



-na'(e) 



(72) 



Proof: The proof is provided in Appendix |Dj ■ 

Remark 5: Lemma |5] is termed exponentially information stable ll33l Section 2]. □ 
We next apply Lemma [5] to Lemma |4| and Lemma [3j to bound the first term of (1631) . Then by 
using Lemma [2l which bounds the second term on the right hand side of (|63l) , we have the 
following lemma: 

Lemma 6: For a given e > 0, if 5 n is chosen as: 



<5 n > max{2e, e H — log 2 e} 

then there exists a constant d such that for sufficiently large n, we have: 



E ( 



2J2pw(w) J \f^ n {z n )-f^ l]w {z n \w)\dz n 

J z n 



< exp(-cn) 



and 



E c [d 7iC ] < E c 






< exp(— dn) 



(73) 



(74) 



(75) 



The value of d depends only on e and ep. The minimum n for (1741) and (T75T) to hold depends 
only on sp. 

Proof: The proof is provided in Appendix [0 ■ 

Note that (1751) is the result mentioned in the first step in the proof outline. 

We next construct the finite set Sm of quantized eavesdropper channel state values as men- 
tioned in the second step of the proof outline. Sm is defined as follows: If the real and imaginary 
parts of each element in MH 7 are integers, 7 is in Sm- Note that from (l36l) . HH 5 = In e xn e , 
hence the absolute value of the real and imaginary parts of each element in H can not exceed 
1. Therefore Sm is a finite set with at most (2M + i} 2N tN e components. 
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Then from ( 1751 ), we have: 

J2 E c Kc] < (2M + 1) 2NtNe exp(-c'n) (76) 

7£S M 

Remark 6: Note that this is the same strategy used in proving the compound channel coding 
theorem in |[35l . Reference [35] considered a discrete memoryless channel which is taken from 
a potentially infinite set and Sm is constructed by quantizing the channel transition probability 
matrix. Here, since we are considering the Gaussian channel, doing so will not lead to a finite 
set. Hence we construct Sm by quantizing the channel gains instead. □ 

Since the codebook ensemble is constructed as in OTTl . for some n , we have, that OTI 



A < 5exp(-nE(R(5'))),Wn > n (77) 

where A, defined in (1571) . is the average probability of the decoding error for the codebook 
ensemble . 

Hence, as in ll27l Appendix II, Section E], from Markov inequality and (1771) . we know there 
must exist one codebook such that 

1) The probability of decoding error of the intended receiver vanishes as n — y oo. 

2) For each 7 G Sm, we have 

d 7 ,c <2J2pwM f |/ 7i y S CO - / 7 ,Yg| W (*» \dz n (78) 

<3 X 2(2M + ifN T N Ee -c'n (79) 

Also, we observe, by our definition of the codebook ensemble that, for this fixed codebook, the 

average power of each codeword must be smaller or equal to P. 

This concludes the second step in the proof outline. From here onward, all the discussion is 

considering on this fixed codebook. 

We next evaluate d lt c when the eavesdropper's channel matrix H 7 is indexed by 7, 7 ^ Sm- 
Let Aj denote the ith row of matrix A. We know there must exist a 7' G Sm, such that for 

the zth row of Ah(k) = H 7 (A;) — Hy(fc), denoted by Ah t i(k), we have: 

|| A h>i (k) f < 2N T /M 2 , i = l,...,N E ,k = l,...,n (80) 

With the notation (|34|) . we define A™ = A^x n , x n G C. Note that x n is an N T x n matrix and 

trace[x n (x n ) H ] < nP,\/x n G C. 
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Let A max (A) be the largest eigenvalue of matrix A. Then for the ith row of A™, A" i5 we 
have: 

=-||A^x"|| 2 (82) 

1 - 
=-V||A M (A;)x(fc)|| 2 (83) 

n *-^ 

k=\ 
1 n 

<-^ A max(s(fc)(s(fc))") ||A M (A;)|| 2 (84) 

fc=i 

<^^(^)(^)) ff )^ (85) 

fe=i 

<i £ trace (x(k) (x(k)f) ^ (86) 



fc=i 



<tracef^^)(^)H^ (87) 

2N T P 

In (1851) . we use (l80l) . In (f86l) . we use the fact that the eigenvalues of \x{k) (x(k)) are nonneg- 
ative. 



It follows then that 



For e > 0, define r' and r as: 



1 9 2N T N F P 

- A" 2 < TJ . (89) 



n - ' xu " M 2 ' 



, ,,, 2N T N E P 

(r'f = —J^f- (90) 



r = r' + 0M1 + e) (91) 

With X n and Y n being the inputs and outputs of the eavesdropper channel with states H™, 
Y n — H"X n is a zero mean rotationally invariant Gaussian distribution whose covariance matrix 
is an identity matrix. Since from ( |9T| ), it follows that r 2 > N E (l+e) > N E , there exists a positive 
a(e), such that (32l (B2)]: 



n 



Y n - H"X" 



2 



>r 2 |X n = x n ) < e - na{e) (92) 
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Note that this bound is uniform regardless of the value of the channel matrix H™. 
Lemma 7: Define g(r,r') as 

g(r,r') = r'(2r + r') (93) 

if we can choose M with respect to n such that 

ng(r,r') < 1 (94) 

then there must exist 7' G S M such that 

d,,c <2j^Pw(w) I |/ 7) y S (z n ) ~ f^ c \w (*» \dz n + 8e~ na ^) (95) 

w J 

<2J2pwH J |/ 7 , : Y g (z n ) - f^,^ clw (z n H \dz n + 12e-" a ^ + 4ng(r, r') (96) 

<12(2M + lfN T N Ee -c'n + 12e -n«(e) + ^^ ^ (97) 

Proof: The proof is provided in Appendix E ■ 

Remark 7: The proof of Lemma [7] requires the property that the average energy of each 

codeword in the codebook does not exceed P. This is the reason we need to sample from 

distribution (|46|) when we construct the codebook ensemble. 
□ 
Lemma 8: There exists a codebook, such that for c > 0, we have 

d 7>c < exp(-c n), V7 (98) 

Proof: g(r,r') decrease at the rate of l/M. Hence there must exist a positive constant 

cm > 0, such that M = exp(ncA/) and both 2(2M + l) 2Ar riv B eX p(— c'n) and ng(r,r') decrease 

exponentially fast to with respect to n. Applying it to Lemma [71 we have Lemma [U ■ 

Let c 4 = 5' + max{2e, e + 2&± log 2 e}. From (ISTI) . (|52|) and (l73l . we observe the codebook 

rate is given by 

lim -H (W) > I fX; y) - A^ S C (P(l - e P )) - c 4 (99) 

where C(x) = log 2 (l + x). From (|5Q|) . we notice that (l99l) can be made arbitrarily close to 

I (x-y) - N E C (P)) (100) 



HE AND YENER, SUBMITTED TO IEEE TRANSACTIONS ON INFORMATION THEORY 23 

To prove that (1 1001) is an achievable secrecy rate, we need the following lemma from ||33ll , 
which relates d 7 c to the mutual information I [W; Y™ j : 

Lemma 9: ||33l Lemma 1] Let | W| be the cardinality of the message set W. Then we have: 

|W| 



I[W;Y;) <d JjC log 2 ^ (101) 



As shown by Lemma[8l the variational distance d lt c decreases to exponentially fast with respect 
to n. Since W is uniformly distributed over W, log 2 |W| is H{W). As shown by (l99l) . H (W) 
increases linearly with n. Hence from Lemma |U / ( W; Y™ j decreases to exponentially fast 
with respect to n. 

This, along with the fact that W is received reliably by the intended receiver and the average 
power constraint is satisfied by each codeword in the codebook, shows that the rate of the 
codebook given by (1 1001) is indeed an achievable secrecy rate. 

The achieved secrecy rate can then be found by evaluating (1 1001) based on (1381) and (l40l) . 
which leads to (T23T) . This concludes the proof for the static case. 

We next extend the result we derived for the static channel to the case where the eavesdropper 
channel is arbitrarily varying. 

E. Arbitrarily Varying Eavesdropper Channel 

When the eavesdropper channel is arbitrarily varying, the second step in the proof for the 
static case must be modified. This is because, even though the variational distance decreases 
exponentially fast, the size of the subset Sm of the eavesdropper channel state sequences also 
increases exponentially fast. In this case, Markov inequality is not sufficient to guarantee the 
existence of a good codebook and the correlation elimination argument from ll36ll must be used. 
The proof outline is as follows: 

1) The first step is the same as the static case. We prove for any given sequence of the 
eavesdropper channel states, the variational distance averaged over an ensemble of wiretap 
codebooks decreases uniformly and exponentially fast with respect to the code length n. 

2) Then, for the finite a subset of quantized eavesdropper channel state sequences, we use 
the correlation elimination argument from ll36ll to show that there exists a small number 
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of codebooks in the codebook ensemblej such that the variational distance averaged over 
these codebooks is small when the eavesdropper channel state sequence is within the finite 
set. This is proved by showing that the probability that the variational distance averaged 
over these codebooks exceeds any given constant is swper-exponentiaily small with respect 
to n for an eavesdropper channel state sequence within the finite subset. 

3) The third step is the same as the static case. We show that when the eavesdropper channel 
state sequence is outside the finite set, the variational distance averaged over this small 
set of codebooks can be approximated by the variational distance when the eavesdropper 
channel state sequence is in the finite set and hence is also small. As in the static case 
proof, a small variational distance implies that the secrecy constraint is satisfied. 

4) We then use the small set of codebooks to construct the coding scheme using a two stage 
transmission scheme introduced in ll36l . 

We next start the proof by defining a normalized version of the variational distance. For a 
given codebook C, and a given eavesdropper channel state sequence 

(H 7 (l),..,H 7 (n)} 

define the normalized variational distance d' c as: 

<c = \ 52pwM [ \kn (^ n ) - / 7 ,Y«|iy (*» \dz n (102) 

w Jz " 

Clearly, we have 

< d 7>c < 1 (103) 

Also, from (|95l ) in Lemma [7J we have: 

d lfi < 4d' 7iC + 8e~ na{£p) (104) 

We then use Lemma [6] to bound d! c . Note that Lemma [6] still holds when the eavesdropper 
channel is arbitrarily varying. 

From ( 1741 ) in Lemma [6J there must exist a constant c', which only depends on e and Ep such 
that 

E c [d' lfi ] < exp(-c / n) (105) 

3 In our case, K — e e n codebooks, where e' is a positive constant that can be made arbitrarily small. 
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Applying (11051) to ( 11041 ), we complete the first step in the proof outline. 

We next use the correlation elimination argument from ll36ll and consider K codebooks, each 
generated as described in Section lTV-Cl Denote the kih. codebook with Ck. Ck is a random variable, 
and so is jr J2k=i <^yC • Since for different k, Ck are i.i.d., d! c are also i.i.d.. These facts, along 
with (11031) . mean that the derivation in ll36l (4.1)-(4.5)] can be applied here. In particular, the 
j, Tj, e and R in 11361 corresponds to k, d' e , d and K here respectively. Consider a positive 
sequence {e n }. Reference 11361 (4.1)-(4.5)] shows that if (11051 ) holds, then for a' > and for n 
such that: 



we have: 



Let a' = 2. Then we have 



l + e a e~ cn <e tn (106) 



< e -(«'-i)^». (107) 




\ fe=i 



^\j<l^^c k >tn\<e-^ K . (108) 

Define the following finite set Sm of 7 : If the real and imaginary parts of each element in MH 7 (i) 
are integers for all i = 1, ...,n, then 7 G S M - Note that from (1361) , H(i)(H(i)) H = I NexNe , 
hence the absolute value of the real and imaginary parts of each element in H(z) can not exceed 
1. Therefore S M is a finite set with at most (2M + l) 2JV rAr B n com p 0nen t s . 
Let IiS'mI denote the size of the set Sm- Then we have: 



Pr 



(^E<A< e n,V 7 eSMJ (109) 

Pr (^E<c fc >^j (HO) 



M-I^m. 

=l-|^ M |e- e ^ (HI) 

When 7 ^ 5ji/, from ( |96l ) in Lemma [Vj we have that if 

ng(r,r') < 1 (112) 

then there must exist 7' E S M , such that 

<,c<4,c + e- nQ(£) +^(r,r'). (113) 
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Recall that r and r' were defined in ( 19TT ) and (1901) respectively. It follows that we have: 

JC S ^ ~ ^S <'A + e " na(£) + ^, O- (1 14) 

fc=i fe=i 



From Markov inequality and (1771) . we have: 

Pr (A Cfc > 5nKe- Np ^ 5 '^ < -L (H 5 ) 



Therefore: 



Pr ^A; : A Cfc > hnKe- nE{R{8 'A (116) 

< J2 Pr ( A c fe > 5n^e-" £ ^'))) (117) 

fe=i 

<- (118) 

n 



Or equivalently 



Pr (A Cfc < 5nKe- nE W», k = 1, ..., If) > 1 - -. 



(119) 



We next choose e n , the number of codebooks K and the variable M, which controls the size of 
the set \Sm\ carefully such that for sufficiently large n, 

1) (11061) is satisfied. 

K 

2) jc X] ^7C fe m til 091) vanishes with high probability for 7 e SW- 

fc=i 

K 

3) ^ X] ^7,c fc on me l e ft h an d side of (11141) vanishes for 7 ^ Sm- Note that in order to use 

fc=i 
the bound (11141) to prove this result, (11121) must be satisfied and the right hand side of 

(11141) must vanish as well, which relies on [2]). 

4) \ Ck , k = 1, ..., K in (11191 ) vanishes with high probability. 

Satisfying these conditions leads to the claim that there exists K good codebooks. 

A proper choice for e n , K and M is as follows: Recall that a(e) was defined in <l92l) . a(sp) 
was defined in (|49l) and (|50l) . For a positive constant e' such that 

£' < d (120) 

e' < a{e) (121) 

e' < a(e P ) (122) 
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2e' < E(R(6')) (123) 

e n , K and M are chosen to be: 

e n = e~ n£ ' (124) 

K = e 2e ' n (125) 

M = e 2e ' n (126) 

d in (11201) was given in (11051) . 

We first check if these choices satisfy (1 106b . We observe that, since e n > 0, the right hand 
side of (11061) is lower bounded as: 

e e " > 1 + e n (127) 

which, due to (I124|) . equals: 

1 + e~ e ' n (128) 

Due to (11201) , we find (11281) is greater than the left hand side of (11061 ) for sufficiently large n 
such that 

1 + e 2 e- c ' n < 1 + e~ £ ' n (129) 

Hence, (11061 ) is satisfied. 

Next we observe from (|124D and (11251) that 

e _ enK = e _ e -^' e W = e -e-' (130) 

We also observe that, due to (11261) . for sufficiently large n, 

2M + l<e 4e ' n (131) 

Hence, 

\S M \ = (2M + I)™* 1 **" < e SN T N E e>n* (132) 

Therefore, from (11301) and (11321) . we have: 

lim \S M \e~ enK = (133) 
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This means (11111) will converge to 1 when n goes to oo. Since e n is shown by (11241) to converge 

K 

to when n goes to oo, we observe, from (|109l )- (lllll) . that -^ Yl ^7,c fe m (1 1091) vanishes with 

fc=i 
high probability. 

We next examine (11141) . We observe from ( 1901) , ( 19Tb and ( 1931 that g(r,r') decreases at the 

rate of 1/M which, according to (11261) . equals e~ 2e n . Hence for sufficiently large n, we have 

ng{r, r') < e - L5£ '" < e" £ ' n = e n (134) 

holds and (11121) is satisfied. 
Also, due to (11211) . we have 

e ~na(e) < g -n £ ' = ^ (135) 



If, for the i in (1114b . 



1 * 

^XX',c fe < e « ( l36 ) 

fc=l 



then, from (1134b . (1135b and (|114b . we have 



1 ^ 

^E<A< 3e n ( 137 ) 






Hence, from (I109b - (llllb . (1133b and (I136b - (ll37b . we observe there must exist K codebooks, 
where K is given by (1125b . such that for any k and 7, 



A Cfc < 5nKe- nEW5,)) (138) 

1 K 

^E<A< 3e " ( 139 ) 



e n is given by (1124b . 

We next check if our choice of K leads to a vanishing \c k . By applying (1125b to the right 
hand side of ( 1138b . we find it equals: 

5m; -n(W'))-2 £ ') (140) 

Due to (1123b . we find that the right hand side of (1138b converges to when n goes to 00. This 
means: 

lim \ Ck = 0, VA; (141) 
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We next express (11391 ) in terms of d ltCk - Due to (11221) . we have, from ( 11041 ), for sufficiently 
large n: 

12e n = 12e- n£ ' > % e - na(ep) (142) 

Hence (11391 ) implies 

1 - 

xJ2 d ^ <24e - v ^ (143) 

fc=i 

(11431) concludes the second and third steps in the proof outline. 

We next use the K codebooks to construct the coding scheme. Let the confidential message 
W be uniformly distributed over the set of {1, ..., TVj}. The encoder f n used by the transmitter 
is described as follows: 

1) In the first stage, the transmitter chooses the value for an integer K' from {1,...,K} 
according to a uniform distribution. Given W = i, f n outputs the label (i,j) computed by 

Jn,C K i • 

2) In the second stage, K' is transmitted to the intended receiver using a good channel 
codebook for the main channel. 

The decoder of the intended receiver first decode K', then decode the confidential message using 

Let K' be the result decoded by the intended receiver for K' . Then 



Pr [W ^ W) (144) 

< Pr (k 1 ^ K') + Pr (w ^ W\K' = K'\ (145) 

1 K 

= Pr(W £') + -£ A Cfe (146) 



fc=i 
Since 



lim Pr (k 1 ^ K') = (147) 

and (11411) holds, we have lim^^oo Pr [W ^ W J =0. 

The variational distance for this coding scheme, <i 7 , is given by 

d 1 = d( PwVK'f^ y« , PwPk'L v« \ W ) (148) 

V C K< C K<' J 
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= Y,Pw (w)pk' (k) f \f Jt y cl (z n ) - f 7! y cl]w (z n \w) \dz n (149) 

k,w 
1 K 

=^E^c fc (150) 

fe=i 

From (11431) and (11241) . we observe that (11501) decreases at the speed of e~ e n . Then from Lemma[9l 
we have: 

lim I (W; K f , Y") = 0, V 7 (151) 

The convergence is uniform over all possible eavesdropper channel matrix sequences and the 
limit decreases exponentially fast with respect to n. Let n' denote the total number of channel 
uses. Then the second stage takes n 2 channel uses with n 2 given by: 

n 2 = s log 2 K = n (152) 

where Rq > is the rate of the conventional channel codebook Cq. The first stage takes n 

channel uses. Therefore 

( 2e'\og 2 e \ 
n = n + n 2 = I h 1 I n (153) 



Define c(e') as 



= 2^ + l (1J4) 



which can be made arbitrarily close to 1 by making e' small. 

Let Y™ 2 denote the signals received by the eavesdropper during the second stage. Then 



lim I(W;Y") (155) 

n'— >oo 

lim I[W;Y"Y^} 

n'— >oo v 



< lim I[W;K',Y") (157) 

= lim I (V; K', Y") (158) 

=0, V7 (159) 
Let C4 = 5' + max{25, e + 2&1 log 2 e}. The secrecy rate is then given by: 

lim -E (W) > (I (X; y) - iV s C (P(l - e P )) - c A )c( £ ') (160) 
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From ([501) , we notice ( 11601 ) can be made arbitrarily close to 

I (x-,y) - N E C (P) (161) 



Therefore, the same secrecy rate as given in (1231) is achievable even when the eavesdropper 
channel is arbitrarily varying. 

Remark 8: In order to use the correlation elimination argument from ll36ll . we made three 
modifications to its proof: 

1) Instead of using average error probability as in [36], we use the normalized variational 
distance defined in (11021) . 

2) In ll36ll . only K = n 2 codebooks are used. Here, in order to use Lemma [9] to bound the 
mutual information with the variational distance, we use K = e £n codebooks. 

3) In [36]|, the index of the codebook used at the transmitter, i.e., K', needs to be reliably 
communicated to the receiver over an arbitrarily varying channel. In this work, K' is 
transmitted using a good channel codebook for the main channel which is static. On 
the other hand, K' may or may not be reliably received over the arbitrarily varying 
eavesdropper channel. We simply assume K' is revealed to the eavesdropper in order 
to compute the lower bound on the achievable secrecy rate which is our goal. 

□ 

F. Achievable Rate with Weak Secrecy with a Static Eavesdropper Channel 
The weak secrecy constraint is expressed as 

lim -J(W;Y!?) = 0, V 7 . (162) 

n— >oo n 

The proof of the weak secrecy rate differs from that for the strong secrecy rate in Section ITV-D1 
In particular, instead of using the information spectrum method from ll34l . we use an argument 
that is similar to [fTTTl . This means that we prove the existence of a codebooks composed of a 
number of sub-codebooks with the following property: Each sub-codebook is a good channel 
code for the eavesdropper channeQ The entire codebook is a good channel code for the main 
channel. These properties allow us to bound the equivocation as in [fTTTl . 

4 That is to say that if the eavesdropper knows the transmitted signals are restricted to a certain sub-codebook, it can decode 
the transmitted confidential message reliably. 
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We start the proof by describing the codebook ensemble. Any codebook in the ensemble 
is constructed by sampling 2 nR sequences in an i.i.d. fashion from the distribution Q^ n with 
E P = 0, where Q^„ was given by (|46l ). 

For weak secrecy, R is chosen as 

R = I(X; Y) - 25 n (163) 

{S n }, which will be specified later, is a positive sequence that converges to when n goes to 
oo. 

Each time we sample a codeword, we label it with (i,j), i G {1, ..., Ni}, j G {1, ...,Nj}, 
where JVj and Nj are given by 

Ni = 2 n ( i? - / (X;Y)+<5„) (164) 

Nj = 2"( 7 (X;Y)-«5„) (165) 

Note the difference of the choice of Nj in (11651) from that used in the strong secrecy proof, i.e., 

453). 

Labeling is done as it was in the strong secrecy proof: Initially i — j — 1. After we label 
a codeword, if j < Nj, then j is incremented by 1. Otherwise, i is incremented by 1 and j is 
reset to 1. 

The intended receiver uses the same decoding rule as in (1541) . 

We also define a fictitious decoder 7 used by the eavesdropper whose channel state matrix is 
H 7 . The decoder computes j given i = i and Y n = y n , and is a maximum likelihood decoder: 

7 (y n ) = arg max \\y n - fite? J (166) 

r-x^ec 

With the decoders defined, we can then, as in ifTTl Appendix A], define the following proba- 
bilities of error when the codeword X™ • is transmitted: 

We use r]~f,j\i to denote the error probability for the eavesdropper to reliably decode j given i 
and Y n when the channel state matrix is H 7 . 

Let the distribution of i,j as p it j. Then we can define the average probability of decoding 
error, r\ 1 , as 

rjj = ^2Pi,j( i J)Vi,j\i (167) 

hi 
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In (11671) , Pij is determined by the encoder /„ used by the transmitter, which we shall specify 
next. Let the confidential message W be uniformly distributed over the set of {i}. Given W = i, 
f n selects a codeword from all the codewords with label % according to a uniform distribution. 
With this encoder, we note that p iy j is uniform, and therefore 

H(± n ) = nR (168) 

For the intended receiver, we simply follow the definitions of the probabilities of decoding 
error in (I55l)-<l57b. 

We then use the following facts: 

Lemma 10: For the codebook ensemble described above, Ec[r/ 7 ] is the same for all 7. 
Proof: The proof is provided in Appendix [Gj ■ 

Then, as in the proof of the strong secrecy rate, we quantize the channel gains of the 
eavesdropper channel and construct the same finite set Sm we used in the strong secrecy proof. 

From OTl (7.3.22)], we know that there exists an error exponent E(R) > such that, for 
some uq, 

A = E C [A C ] < 5exp{-nE(R)),\/n > n . (169) 

By the same argument, for an eavesdropper whose channel matrix is H 7 indexed by 7 G Sm, 
we know there exists an error exponent EUR) > such that for some no, 

E c [%] < 5exp(-n£ 7 (£)),Vn > n (170) 

where R = I(X,Y)- 5 n . 

Remark 9: The constant factor of 5 in (I169l) - (1170l) and the requirement n > no is used to 
bound the term (l/u) 1+p in [31, (7.3.22)], since p < 1 and limj^oo a = 1/2. Hence n is not a 
function of 7. □ 

Note that by Lemma ITOl Ec[?7 7 ] is not a function of 7. Hence, if an error exponent holds for 
a certain 7, it holds for all 7. Therefore, we can omit the subscript 7 in the error exponent and 
rewrite it as E'{R). 

Recall that 25 n = J(X, Y) — R. Hence, we can rewrite both E(R) and E'(R) as a function 
of S n . From [31], E(R) and E'(R) have the following property: For R > and R > 0: 

1) E(R) and E'(R) are both positive. 

2) Both E(R) and E'(R) are monotonically decreasing functions of 8 n . 
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3) If S n -> 0, then both E(R) and E'{R) converge to 0. 
Let E(5 n ) = max{E(R), E'(R)}. Then E(5 n ) also has the three properties listed above. From 
the linearity of expectation, for sufficiently large n that does not depend on 7, we can write: 



Er 



T6S M . 



< 5((2M + 1) 2N tN e + iy-E{5 n )n (171) 

This means there must exist one codebook in the ensemble such that 

A c < 5((2M + \) 2N t n e + iy-E{K)n (172) 

r? 7 < 5((2M + 1) 27V ^ + i) e -B(«»)" (173) 

We next consider the equivocation for one eavesdropper whose channel matrix is in the set 
S M , with this codebook: 



H (W\Y^j (174) 

=H (w\yA - H (w\Y^ X n ) (175) 

=1 (W;X n \Y^ (176) 

=# (x n |Y?) - H (± n \W J YA (177) 

Applying Fano's inequality 11371 to the second term in (11771) . we find it is upper bounded by: 

H (x n |YlA - 1 - rj^nR (178) 
Applying (11731) to (11781) . we find it is upper bounded by: 

H (x"|Y^) - 1 - 5nR ((2M + 1) 2NtNe + l) e -^(*»)» (179) 
Define e n as: 

e n = - + 5R ((2M + 1) 2JVtAFb + 1) e -^(*»)» (180) 
Then, we can rewrite (11791) as: 

ff (x n )-/(x n ;Y?)-ne B (181) 

># (x n ) - h (y?) + ft (y; i |X") - ne n (182) 

=ni2 - /i fc) + /i (Y!;|X n ) - ne n (183) 
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where (11831 ) follows by applying ( 11 68b . 
To proceed, we need the following lemma: 
Lemma 11: 

h (y?) < N E n\ogne{P + 1), V 7 (184) 

Proof: The proof is given in Appendix [H] ■ 

Using Lemma [Hand (I168D and the fact that h [Y™|X n j = nN E log ire, we find (11831) is 
upper bounded by: 

nR - nN E log 2 (1 + P) - ne n (185) 

=n (i (X; Y) - N E C (P)) - n(25 n + e n ). (186) 

Hence 

H (w\Y^ >n(l (X; y) - N E C (P)) - n(26 n + e n ). (187) 

On the other hand, H (W) is given by: 

H (W) = n (i (H; y) - I (X; Y 7 )) - n8 n (188) 

=n(l(±-Y^-N E C(P))-n5 n . (189) 

Therefore we have 

l{w-Y^j <n(5 n + e n ). (190) 



We next derive an upper bound on / ( W; Y" J when the eavesdropper's channel matrix is not 
in S M . 

Let r 2 = 2N E and (r') 2 = 2N \% eP ' . Define a as in (HU) with r 2 = 2iV B . Let # r , r / = r'(2r + r'). 

Let H 7 denote the channel matrix of the eavesdropper. From our construction of Sm, we 
know there must exist an Hy indexed by 7' G Saj such that (l80l) holds. 

We let the eavesdropper with channel matrix H 7 use the same "fictitious" decoder we designed 
for the eavesdropper with channel matrix H' r/ 7 be the corresponding probability of decoding 
error with this decoder. Then we have the following lemma: 
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Lemma 12: 

^ < e~ na + 5((2M + \) 2N t N e + 1 ) e -(J(«n)-ff(r,r')n (191) 

Proof: The proof is provided in Appendix HI ■ 

We next repeat the equivocation computation in (I174l) -( |190l ). This yields: 

l(W;1q) <n(6 n + e' n ) (192) 

where 

e' n = - + R (e~ na + 5((2M + \) 2NtNe + 1) j e -(E(s n )-g(r,r'))n (193) 

The last step of the achievability proof requires choosing S n carefully with respect to n, such 
that e n and e' n goes to as n goes to oo. This can be done by choosing E(8 n ) properly as 
follows: 

1) E(6 n ) decreases to at the rate of n~ l l 2 , which ensures nE(5 n ) — > oo as n — > oo. 

2) M increases at the rate of n, hence g(r, r') decreases at the rate of rr 1 . Therefore n(E(5 n ) — 
g(r,r')) — > oo at the rate of exp(— Ci\/n) for c\ > 0, as n — > oo. 

Since E(6 n ) is a monotonically decreasing function of S n , this means S n converges to as 
n — V oo. We also observe in this case both e n and e' n converge uniformly to as n — > oo for 
any eavesdropper channel matrix. 

In summary, we have shown that for any eavesdropper, with the same codebook C, we always 
have 

lim -I (\V; Y") = (194) 

n->oo n \ V 

The convergence is uniform over all possible values of the eavesdropper channel states. 

The reliability requirement © is fulfilled by (11721) . 

The average power constraint Q> is guaranteed by the way the codebook ensemble is con- 
structed. 

Remark 10: The secrecy rate found ( 11891 ) is identical to the rate we derived with strong 
secrecy requirement in (11001) . □ 
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G. Converse for Corollary [7J 

In this section, we establish the result in Corollary [Tj by providing the converse for the high 
SNR characterization of the secrecy rate found in (11611) . 

Since H can be arbitrary, when N E > N T , we can choose H as [I NtxNt , NtX ( Ne _ Nt )] t . The 
eavesdropper in this case has perfect knowledge of the transmitted signal. Clearly, the secrecy 
capacity is 0. 

We next consider the case when Ne < Nt- We use X{ to denote the zth to the jth component 
in a vector X. The secrecy rate is upper bounded by JH: 

/(X;Y|Y) (195) 

When N T > N R , we assume H = [B NrxNr ,0 NrX{Nt _ Nr) ] for a diagonal matrix Djv HXA Ji 
Since H is arbitrary, we choose H as [In e xNe^n e x(Nt-n e )\- Then (11951) equals: 

/ (X; B NrxNr X^ + Z\X^) (196) 

=/ (X^,X^ r+1 ;B NrxNr X^ + Z\X?*) (197) 

=/ (xf«; D NrxNr X?» + Z\X? E ) + I (X$Z +1 ; D NrxNr X?« + Z\X?* , X?*) (198) 

=/ (X?*; D NrxNr X?* + Z\XF B ) (199) 

When N T < N R , we assume H = [Dn t xn t -,On t x{n r -n t )] T for a diagonal matrix D NtxNt . 
We use the same H as we did in the previous case. Then (11951) equals: 

/ (X; D NtxNt X? t + Z? T , Z%« +1 \X? E ) (200) 

-J [A, L)at tX jv t A 1 + Z 1 |A X J + 1 (^A., Z ArT+1 |Ujv T xA r T ^-i +^1 ) A i J ( ZU1 J 

=/ (X; D NtxNt X? t + Zf T |Xf B ) (202) 
Define N m = mm{iYV, Nr}. Then, in both cases, (11951 ) can be written as: 

I (Af ™; D^x^Xf- + Zf-|Xf B ) (203) 

=1 ( Xf m ; Y? m | Xf B ) (204) 
which equals: 

I{X^; +1 -Y X N -\X^) (205) 

Else, we can perform SVD on H and transform it into this form. 
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=h(Y^ +l \X^) + h(Y^\X^ ,Y^ +1 ) - fc(lf»|X*») (206) 

<h(Y^ +1 ) + h(Y^\X^,Y^ +1 ) - h{Y^\X^) (207) 

<h(Yg™ +1 ) + h(Y* E |Xf E ) - h(Y* m |Xf m ) (208) 

=h{Y^ +l ) + /i(Zf E |Xf E ) - /i(Zf m |Xf m ) (209) 

=KYnz + i) + M^ E ) " KZ^) (210) 

=M^T + i)-M^r +1 ) (211) 

=M^+i) - KY^JX^ +1 ) (212) 

=A*&+i;?& m + i) ( 213 ) 

Since we assume H of the original MIMO wiretap channel has a full rank, Djv mX Ar rn also has 
full rank. Hence the elements on the diagonal line of D are all positive. This means equation 
(12131) increases at a rate of 0((min{iYV, N R } — N E )C(P)). Hence we have proved the converse 
of Corollary [TJ 

V. Extension to the MIMO MAC Wiretap Channel and the MIMO Broadcast 

Wiretap Channel 

In this Section, we extend our results to secure communication in multiuser MIMO channels 
with arbitrarily varying eavesdropper channel states. In particular, Theorems [2] and [3] are proved 
next. 

We first prove Theorem [2] for the MIMO MAC-WT. We observe that the secrecy rate region 
in (|26l is achieved by time sharing, i.e., letting user 1 transmit during a fraction of the channel 
uses alone, and user 2 for the remaining channel uses. The region then readily follows from 
Theorem [Q The achievability of the s.d.o.f. region follows from the achievable secrecy rate 
region (|26l , by letting P 1 = P 2 = P — V oo. 

For the converse, we simply combine the two transmitters. The channel then becomes a 
single-user MIMO wiretap channel, where the transmitter has 2Nt antennas, the receiver has 
Nt antennas, and the eavesdropper has Ne antenna. d\ + d 2 < maxjiVV — Ne, 0} then follows 
from the converse of Corollary [Q 

We next prove Theorem [3] for the MIMO BC-WT Again we first obtain an achievable secrecy 
rate region by time sharing. The secrecy rates achieved by receivers 1 and 2 are found to be (|27l) 
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as a consequence of Theorem [TJ The achieved s.d.o.f. region then follows from the achievable 
secrecy rate region (T27T) . by letting Pi = P 2 = P — > oo. 

For the converse, we simply combine the two receivers. The channel then becomes a single- 
user MIMO wiretap channel, where the transmitter has Nt antennas, the receiver has 2Nt 
antennas, and the eavesdropper has Ne antenna. d\ + d 2 < max{iYV — Ne, 0} then follows from 
the converse of Corollary [TJ 

VI. Discussion 

A. Methods of Proving Strong Secrecy 

As we have mentioned in Section UJ it is common practice to prove weak secrecy results 
and use privacy amplification ll25l to arrive at strong secrecy with identical rates. Since this 
work deviates from that approach, and derives the strong secrecy rate directly, it is instructive 
to discuss the reason behind it. 

Given a weak secrecy coding scheme that spans over n channel uses, reference G51 considers 
an equivalent channel for which every n inputs to the weak secrecy scheme is viewed as a single 
input to the equivalent channel. It then designs a strong secrecy scheme for this equivalent 
channel. If this approach were followed here, then the arbitrarily varying channel would be 
encapsulated inside a universal weak secrecy coding scheme to form the equivalent channel. 
However, this does not change the fact that the equivalent channel still has an arbitrarily varying 
joint distribution for its inputs and outputs. It can be shown that the resulting coding scheme does 
satisfy the strong secrecy constraint in © for all possible eavesdropper channel state sequences. 
However, the convergence speed of the limit in © is not uniform over these sequences. Due to 
this subtlety, the approach of E51 cannot not be used to prove strong secrecy in this work. 

B. Comparison with Related Work 

In this section, we provide a detailed discussion of the differences of this work from previous 
work that considered settings similar or related to ours. These are: 

• Reference [23]: This reference considered the MISO wiretap channel, and claimed that, with 
a certain probability, a positive weak secrecy rate can be guaranteed by introducing artificial 
noise at the transmitter, even if the transmitter has no knowledge about the eavesdropper 
channel states. However, as pointed out in |[24|. a universal coding scheme is necessary for 
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this claim to be correct. In this work, we proved the existence of such a universal coding 
scheme. 

• References |[33ll and G71 : The possibility of using information spectrum IJ341 to prove coding 
theorems for wiretap channels was first suggested in [|33l . Recently [|27l provided a more 
detailed proof based on this. The proof of E71 can be easily extended to the case of having 
& finite number of eavesdroppers, i.e., the compound setting. However, in this work, we have 
to consider infinitely possibilities for eavesdropper channel state sequences. This makes the 
proof in this work differs from E71 in the following aspects: 

1) To prove the results in ll27l . it is sufficient to prove that the left hand side of (1721) 
converges to zero as n goes to oo. Here, we must prove it converges exponentially 
fast to zero with respect to n, as otherwise, the existence of universal secure coding 
scheme does not follow. 

2) In order to use the approximation argument from |35|, we need a uniform upper bound 
on the average power of each codeword in the codebook. This was used in obtaining 
(1881) from (1871) . To obtain such a bound, we have to sample from a truncated n-letter 
Gaussian distribution, as shown in (|46|) and (l48l) . which complicates the analysis of 
the information density. In contrast, in the setting of 112711 . it is sufficient to sample 
from a single letter Gaussian distribution. 

The model considered by E71 is also inherently different from the model considered in this 
work in the sense that the sequences of eavesdropper channel states in ll27l must have a 
well-defined n letter distribution. We do not have this restriction in this work. 

• Reference ll24ll : Recently, [|24ll considered a general arbitrarily varying discrete memory less 
wiretap channel and proved the existence of a universal coding scheme for this channel for 
weak secrecy. This work differs from |]2~4| in that we consider a Gaussian model, whose 
inputs and outputs are continuous and we prove strong secrecy. We stress that for the 
arbitrarily varying channel setting ll38l . the analysis for continuous alphabets do not follow 
from its discrete counterpart with finite alphabets | f24l Lemma 3, Lemma 4]. Thus, care 
must be exercised in establishing the results from scratch as evidenced by Section [IV] 
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VII. Conclusion 

In this work, we have considered secure communication in the presence of eavesdroppers 
whose channels are unknown to the legitimate parties and can be arbitrarily varying. We have 
shown that multiple antennas used in conjunction with the universal coding scheme presented 
in this paper can guarantee positive secrecy rates irrespective of the channels of the (possibly 
infinite numbers of) eavesdroppers. 

We have derived achievable secrecy rates for the MIMO wiretap channel, and achievable 
secrecy rate regions for the MIMO MAC wiretap channel and the MIMO broadcast wiretap 
channel where each transmitter(s) and the intended receiver(s) have the same number of antennas. 
We have also derived the secure degrees of freedom, and the secure degrees of freedom regions 
for these channels by matching the converse to the achievable rates in high SNR. These results 
are guaranteed in the most stringent setting, that is in the sense of strong secrecy, which coincides 
with the results derived when the notion of weak secrecy is used and the eavesdropper's channel 
gain is assumed to be static. 

As future work, it is of interest to consider MIMO MAC and MIMO BC wiretap channels with 
asymmetric number of antennas, for which a time sharing scheme is unlikely to be optimal. In 
this work, we considered the case where conditioned on a given sequence of channel states, the 
eavesdropper channel is memoryless. The corresponding channel model with memory deserves 
further investigation. 

Appendix A 
Proof of Lemma [2] 

The second term in (1631) can be bounded as: 



l/ 7 ,Y S (* n )-/ 7 ,Y ? (0(* n )l<fe n (214) 

< / I / / 7 , Y g|x 3 (* n K) /x S (* B ) dx n - J / 7> ^ lS? (z n \x n ) /x» (x n )dx n \dz n (215) 

= / 1 / hn\*c ^> n ) &S ^ d%n ~ J knm ^l*") /x ? (^)^l^ n ( 216 ) 




< / / A,y S |x & (zV) l/*n (* n ) - /x ? (x n ) \dx n dz n (217) 

/t )YS -h«x S {z n - H n ^ n ) |/xg (^ n ) - /x ? (x n ) \dx n dz n (218) 
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Let u n == z n - H n x n . Then (12181) equals 

/ 7 ,y S -h«x S (« B ) l/*s (^) - /x? (* n ) l«fa B d« B (219) 

= / A,y S -h-x S (« B ) / l/*s (* n ) - /x ? (* n ) IcfcW (220) 

For the innermost integral in (12201) . we can write: 

/ l/*» (% n ) ~ /x ? (x n ) \dx n (221) 

= / |/fe (* n ) - /x« (* n ) |dr» + / |/x g (nr») - /x» (*") |ds" (222) 

<[ f^(x n )dx n + [ fx-(x n )dx n 

+ [ \f^ n (x n )-f X n(x n )\dx n (223) 

n I I II 

<(1 " AW) + I |/fe (*") - /vUxg (*") 1^ (224) 

<{l-Hn,e P )+Hnlr- 1 ( 22 5) 

=/ i ni P - /V £P (226) 

From ( |49l , we can choose sufficiently large n, such that fj, nj£p > 1/2. For such n, we have 

Vn]e P ~ Vn,e P (227) 

=Ai^ p (1 - aC) (228) 

<2(1-< £P ) (229) 

=2 (1 - Ai^) (1 + /i n , £p ) (230) 

<4(l-/v £p ) (231) 

Therefore (12201) is upper bounded by 4e _na(ep ). This concludes the proof of the lemma. 

Appendix B 
Proof of ([66]) 

Recall that E B [A] denotes the expectation of A averaged over B. Define L = 2 n ( J ( X;Y ) +<5 "). 
Recall that xfj denotes the codeword in the codebook C that is labeled with (i,j). Since (i,j) 

It is easy to verify that the absolute value of the lacobian determinant is 1 in this case. 
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are uniformly distributed, we have: 



52pw H / |/ 7 ,ys CO - Uy?\w (*» \dz n (232) 

E^ («0 / IA.*s (zn) " i E 4*si*s (^KJ l^ n (233) 

to j=l 

j^pw (w)j jj/x- fe) j i/ 7i y 3 o n ) - ^EA,*?l*g (^ n i^,i)i^ nrf <j,i=i...L 



=E, 



3=1 



i=i 



(234) 



E^ M / A &? fe) / l/ 7f ts CO - t E W*g (^Kj I^ n ^-,i=i...x (235) 
to J i=i J i=i 

/ 11 ^ x t V^ 1 ..// / l-^T.Yg ( Z ) ~~ Y, / ^ A.YglXg ( Z Fljjp 2 ^ X l,j,j=l...L 



~-Er 



--Er 



I l/ 7 ,Yg l 2 ") T 2^ / 7 ,YJ|Xg (^ FljjF 2 

J i=i 



l/ 7 ,Y S (^)-/ 7 ,Y^(^|l)l^ 



(236) 

(237) 
(238) 



which is ( |66l) . 

Appendix C 
Proof of Lemma [4] 

Let M be the number of codewords in each bin in the codebook: 

M = 2 n ( / (*G;Y G )+<5„) (239) 

As in [|34l Proof of Theorem 4], we begin by defining random variables X™, X™, ...,Xjk and 
Y n such that 

1) The distribution of X n is also given by Q^ n . 

2) The distribution of Y n conditioned on X n is determined by the eavesdropper channel. 

3) X?, ..., X^ are i.i.d. and the distribution of X.], j = 1, ..., M is given by Q %n . X™, ..., X n M 
are independent from Y n . 
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Then, we have (M Proof of Theorem 4, (4.2)]: 



E r 



<Pr 



Pr 



log 



Jj,Y n \W ( * c |l 



./• 



y^c 



x c 



M 



v ~ - r "v n '\ rr ' 



> T„ 



> fa. 



+ Pr 



1 M ,- - \ 

^2^ 2 ; >C2,n + T n 



J=l 



where c 2 ,„ and r n > satisfy 



2r n + c 2 ,„ = 2 A 



(240) 



(241) 



(242) 



The values of C2, n and r n will be specified later. 

Let l{a > b} denote the indicator function that equals 1 if a > b, otherwise. For the first 
term in (12411) . we can write: 

M' 



Pr 



7 ,X G Y G V > > T„ 



fin (x n ) / 7i y„|x« (y n k n ) 1 <| ^-W^ > Tn } dx n dtf 



(243) 
(244) 



<^e P J /*» GO / 7 ,y |x S (l/*V) 1 {^-W^ > Tn } cfa B di/» (245) 



</vL Pr 



/vL Pr 



9'S,X"Y", (*G^J ^ _ 

M n 

\nn (xg. *s) > J (xo; Y ^) + <&» + - iog 2 r n 

I L V / V / / 4 



(246) 



(247) 



For the second term in (12411) . we follow 041 (4.4),(4.5)] and define the following random 
variables conditioned on Y n = y n : 

V n>j (y n ) = i^G^a^^) (248) 

Z nJ (y n ) = V nJ (y n ) 1 {V n>j (y n ) < M} (249) 

1 M 
U ** (*") = M E ^ (^) 



3=1 
M 



t m (y n ) = ^J2 z ^ (y n ) 



(250) 
(251) 



i=i 
With these notations, as in II341 (4.6)], we can write: 

M 



Pr 



1 






X",Y" 



M 



> c 2 ,n + T n \Y n = y 



3=1 



(252) 
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= Pr [U M (y n ) > c 2 ,n + r„] 

< Pr (T M (y n ) ^ U M (y n )) + Pr (T M (y n ) > c 2 , n + r n 
For the first term in ( 12541 ), we can write [|34l : 

Pr (T M (y n ) ^ U M (y n )) 



M 



3=1 

=MPi[V nA (y n )>M] 



(12571) can be upper bounded as: 



M 
--M 



Pr 
Pr 



Ki Y n >M 



2 i 7 ,X«Y S ( X ". Y ") >M 



M / f ±n (x n ) / t y»|x« (^k")l 2 - X & Y S VJ - " ; > M <ir n dz 



(x n ,z n ) 



.(x n ,z n ) 



As shown in ||34l Proof of Theorem 4], (12611 ) is upper bounded by: 



/vIp Pr 



1 

— 2_ 

n 



7 ,XgYg I ^G> x G 



X™ Y" > J XrjiY, 



■-G, J G 



This means 

Pi[T M [Y n ) ^U M [Y n 

For the second term in (12541) . we can write 11341 (4.7)]: 



<U~l Pr 



i„. *»™ I X™ , Y™ ) > / ( X G ; Y G ) + 5. 



(253) 

(254) 

(255) 
(256) 

(257) 

(258) 
(259) 

(260) 
(261) 

(262) 

(263) 
(264) 



(x n ) 2 l ^G^G {xn ' yn h \ 2 l ^G^G {x ^ yn) < (265) 

(266) 

(267) 



We choose c 2 „ as 



Xgtfn^M/") < M l ffa .n 



C2,n — /^ n 



,e P 



(268) 
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Then, following KM (4.8)], we have 



Pr (T M (y n ) > c 2 ,„ + r n ) < Pr {T M (y n ) - E [T M {y n )\ > r n ) 
<lvar(T M (y")) 



1 

<-E 

T 



±zl (,») 



The expectation in (12711) can be upper bounded by: 



E 



^ / /x» GO / 7i y«|x« (VV) Zl,i (V n ) dx n dy n 



-y f /*» (* n ) 4y-|x« (l/*V) (K,i (z/ n ) 1 {K,i (y n ) < M}fdx n dy 



M 



_! 1 



dx n dy r - 



(269) 

(270) 

(271) 

(272) 
(273) 
(274) 



/xg ( x ") / 7> y S |x S (y n |» n ) (2^^S^S (x "' s,n) l {2^^S*S (xnyi) - M }) 2 rfx n ^ n (275) 



As illustrated in [34, Proof of Theorem 4,], equation (12751) is upper bounded by: 



/vU2-"^ + Pr 



/y,X S Yg(X^Y£) 



& 



} 



This means 



PrfTji/fY 



< 



T 2 



{2- 



> C2,n + T n 
1 



Pr 



/?. 



S,xg,Yg I -^-^' ^^ I > 1 1 -^-g; y 



l Gi ■ L G 



>-Gi * G 






Substituting (l263T) - (l264l) and (I277l) - (l278l) to (I252l) - (l254l) . we observe: 



Pr 



1 

17 



M 



</Cp Pr 



1 



??. 



A*n,ep 



{2- 



SsX^Y" 



Pr 



> c 2,n + Tn 

X G ,Y G ) >/(X G ;Y G 



^x S y S (Xg,Y g )>/(x g ;Y g )+| 



(276) 

(277) 
(278) 

(279) 



} 



(280) 



Applying this result along with (1243M247I) to (I240I) - (I241D . we obtain Lemma S 
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Define P' as 



Appendix D 
Proof of Lemma [5] 



p- = p <-\-"^ 



N 7 



(281) 



We prove Lemma \5\ when H n is a sequence such that H(z) is given by (l36l) . The case where 
H(i) is invariant with respect to i is a special case, and does not require a separate proof. 
We begin with: 



11/ 7 ,Y|X ( Y d X * 



i=l 



7T 



raiNfe 



exp 



Y n _ H n. x , 



(282) 



where we used the notation in (|32l . Note that with the distribution we choose for X G and the 
channel matrix sequence H n given by (136*1 ), Y G is a rotationally invariant complex Gaussian 
random vector with zero mean and covariance matrix P'l: 



I 



,/ „, On I J- 



' 7 ,Y5 



(ttP 



,\nN E 



exp 



! \ 



V 



P' 



(283) 



Therefore 



77, '' A G "g v 



/ 



=iV E log 2 (P') + {- 
n 



*G 



V 



p> 



2 \ 
/ 



1 

n 



Y G - H n X G 



} log 2 e 



(284) 



Define N n as 



N n = Y G - H n X G 



For a fixed positive constant e 2 , we have: 



PrH 7 ,x S Y S (X G , Yg) > /(Xg; Y G ) 

77, " <-» <j 



<5„) 



*G 



Pr(JV E log 2 (P') + {-(— 

Pr(iV E log 2 (P / ) + 



n P 
log 2 e 



N T 



*G 



??. 



P' 



>/(X G ;Y G ) 



}log 2 e>I(X G ;Y G )H-<5 ; 
log 2 e 



??. 



N r 



+ S n ) 



(285) 

(286) 

(287) 
(288) 
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<Pr(- 
n 



N r 



<iV E (l-£ 2 )) + Pr(- 
n 



N n 



>N E {l-e 2 )) 



Pr(A^log 2 (P') 
log 2 e ~ 2 



log 2 e 



X G 



n 



P> 



n 

<Pr(- 

n 



N r 



W 



>/(X G :Y G ) + 



>N E (l-e 2 ) 



(289) 



N n 



<N E (l-e 2 )) 



+ Pr(N E \og 2 (P')-< 






n 



P' 



> I(X G ; Y G ) + (log 2 e)N E (l - e 2 ) + S n 



Pr(- 
n 



1 


_ 




IN" 


r?. 






2 


N n 


< 



>iV fi (l-£ 2 ^ 
CiV E (l-£ 2 )) 



(290) 



Pr(iV E log 2 (P / ) + 



log 2 e 



G 



> J(X G ; Y G ) + (log 2 e)N E (l - e 2 ) + <S n ) (291) 



n v P' 

Note that N n is a zero mean Gaussian random vector whose covariance matrix is I. Hence, from 
Il32l (Bl)], there exists a(e 2 ), such that 

1 



Pr( 



'nNr. 



N" 



< 1 - e 2 ) < e 



-na(s2) 



In addition, note that 



I(X G ;Y G )-7V E log 2 (P') 

P(l-e P ), 



iV B log 2 (l 



N 7 



iVploKofl 



Hence, the second term in (12911) can be written as: 



-£- > N E (1 - e 2 ) + -*?-] 
n P log 2 e 



Pr( 



'nN F 



X G 



Ip, 



P{l-ep) 

N r 



>l-e 2 + 



(292) 

(293) 
(294) 



S n 



N E hg 2 e' 



(295) 



Each component of —& is a rotationally invariant zero mean complex Gaussian random variable 



with unit variance, regardless of the value of H n and these components are independent. 



Therefore, for e 3 > 0, we have: if for all n, 1 — e 2 
e 2 ) log 2 e, there must exist a(e 3 ), such that J32l (B2)]: 

2 



Sn 



N E log 2 e 



> 1 + e 3 , i.e., 5 n > N E (e 3 + 



Pr 



nNp 



X G 
\[P' 



>l-e 2 



N E log 2 e 



< e 



-na(e3) 



(296) 
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We have obtained an exponential bound on both terms of ( 12911) . Finally, we let e 2 = £3 and 
e = 2N E e 2 log 2 e. Hence 8 n > e, and we obtain Lemma [51 

Appendix E 
Proof of Lemma [6] 

Combining (12421) and (12681) . we have: 

e M„ln2_ _i 

r n = y~ -^ (297) 



Since \x n > 0, we find that (12971) is lower bounded by: 

(298) 



li n In 2 + 1 - /i„ i 1 £p 



2 

From (|49|) . we can choose a sufficiently large n such that /i„ i£:p > 1/2. This means //"* < 2. 
Since from (HU), 1 - pL n>ep < e ~ na ^ £p \ we have 

H~l p - 1 < 2e~ na ^ (299) 

Applying (12991) to (12981) . we have 

u n In 2 - 2e" nQ ^) 
r„ > — (300) 



The remainder of the proof entails finding an upper bound for (1711) . which will lead to an 
upper bound on (1741) via Lemma [3l (1711) can be bounded using Lemma [5] if its conditions are 
satisfied. This means that, for a given e > 0, we require the following three conditions to be 
satisfied for all n. 

y > e (301) 

5 n + -hg 2 r n >e (302) 

n 

r n > (303) 



Suppose all three conditions are fulfilled, then the three terms in (1711) can be bounded as follows. 
The third term, as shown in Lemma [5] and using (|297|) -( |298l ). can be bounded as 



^ ( Pr £ Wa (*£> *S) > J (xo; Y «) + 1] + 2 ~ n5n/2 ) ( 304 ) 

^7— r^ri r^( e_W(£) + 2 ~ n5n/2 ) ( 305 ) 

(/x n In 2 + l-^-i ) 2 
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On the other hand, if ( |301| )- (I303I) hold, the first two terms in Lemma @] are all bounded by 
e -na ( £ ) Therefore, f r0 m Lemma HI we find 



Er 



Pr 



log; 



j~/,Y£\w r*cii 



A.Yg ( Y C 



> /in 



</vL{2e- W(e) + 



1 



Then, from Lemma [H we have 



/ l/ 7 ,Y S (^)-/ 7 ,Y S |V,(^|l)l^ 



From Lemma El we have 



1 (n -na'{e) 



(/i„ln2 + l-/i-i p ) 2 



/ l/ 7 ,*s CO " / 7 ,*» (* B ) l^ n < 4e" nQ( ^ ) 
Finally, from Lemma [Q we have 

EcKc] < E c [2 J>^H / |/ 7i ^ (*») - / 7>Y?|W (s» W 

w JzH 

<E e [2 J^PwH ! l/ 7 , YS (^)-/ 7 , Y «| W (^k)l^1 

+ 2J\f 7>n (z n )-f 7>n (z n )\dz n 



log 2 e p 



(/^n In 2 + 1 - //- 1 



[g-na'M _|_ e -n<5 n ln2/2\\ 



(306) 
(307) 



(308) 

no'(e) _|_ 2-"5 n /2\\ (309) 



(310) 



(311) 



(312) 



(313) 



We then choose 8 n such that (I301I) - (I303I) hold. In order for the bound given by (13131) to be 
small, we choose /i n such that it decreases exponentially fast with respect to n. In order for the 
second term in (13131) to decrease exponentially fast with respect to n, we can choose 

■ r a' (e) 5n ln2 a(ep) -, 

^ = e -nmm{^i,-^,^^} (314) 

The last term inside the minimum, a(ep)/2, is for r n to remain positive, as required by (13031) . 
And as shown by (13001 ), this means for sufficiently large n, whose lower bound only depends 
on s P , we have: 

1 o(E P ) 

Tn > -f~ n — (315) 
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or equivalently: 



1 , ^ a(e P ) , 

--log 2 r n < — — log 2 e 
n 2 

a(ep) 



(316) 



Hence, we can choose 8 n such that 5 n > max{2e, e + a ^ ' log 2 e}, then (13011) and (13021) hold. 



Finally, for the above choices of \x n and 5 n , we note that both (13131) and (13091) decrease 
exponentially fast with respect to n. Hence, we have the two inequalities stated in Lemma [61 



Appendix F 
Proof of Lemma [7] 

As we had for Lemma [51 we prove Lemma [7] when H n is a sequence such that H(z) is given 
by (l36l) and the eavesdropper channel is given by (I4TT) . 

Let f y be the conditional p.d.f. of the eavesdropper channel implied by (|4T|) when the channel 
matrix sequence is H™. 



When i 



Y" - H"X n 



< r 2 , for Y n = z n and X 71 = x n , we have: 



hg f y (z n \x n )- log fy(z n \x r 



n^x n 



z n - H^,x n 



(317) 
(318) 



Recall that AJJ = H™ — H™, and A, denotes the ith row of matrix A. For a matrix A that has 
N rows, let [A 1; ..., An] denote a row vector formed by concatenating all rows of A. Let (x, y) 
denote the inner product operation for the complex vector space. Note that z n is a Ne x n matrix 
here. Hence (13181) can be upper bounded by: 

N E N e 

2|Re^ (z? - fly, A n hii x n ) | + J2 IK 

i=l i=\ 

N E N e 

<2| £; (*» - H>", A^x") I + £ || A^x" 






(319) 

(320) 



8=1 



t=l 



2| ^ - H^x"), . ., (*» a - Hl NE x n )], [A^x", . 

We 



We 



x 



X" 



t=i 



<2W U n -H"x n 



|A n || 2 + ||A n || 2 



(321) 
(322) 
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where in (13221) we use the Cauchy-Schwartz inequality. From (1891 ), we observe that (13221 ) is 
upper bounded by: 

ng(r, r') = nr'(2r + r') (323) 

From Lemma [Q (l62l)-(l63l and Lemma [H we have: 

d,,c < 2 J>^H I |/ 7j y ? n ) - / 7) yj| W (*» |^ n (324) 

<2J2pwM f |/ 7i vg (^ n ) - / 7 ,y«| W (*» l^ n + 8e-™^) (325) 

Hence we have obtained ( |95l ) in Lemma |7J 

Recall that Yq is the signal received by the eavesdropper if X n = X^. Since the input 
distribution we choose for X" is zero mean rotationally invariant Gaussian with covariance 
matrix (P(l — e p ))I NtxNt , and H 7 (i) always has the form given by (l36l) for all 7, we have 

kn CO = fy,n CO (326) 

Therefore, the first term in (13251 ) can be written as: 

+ 2^p^H [ \fy, n (z n ) - fy,Y2\w(z n \ w )\ d z n ( 328 ) 

Recall that we label each codebook with (i,j). In the encoder, we let W = i, the distribution 
over j be p^, which is uniform. We denote the codeword with label (w, j) by x™ -. Then, each 
term inside the sum over w in the first term of (13281) can be upper bounded as: 

/ \f 7 S?\w C*» - /y,*g|wr (*» l^ n (329) 

^ X> / I A,y-|x- WJ - /y,*»|*- (0<;) l<** n (330) 

3 

The term inside the sum over j can be upper bounded by: 

/ l/7,Y"|X n \ Z \ X w,j) ~ Ji',~Y n \X. n \ Z \ X w,j) l" z (331) 

= / - ll2 lj7,Y"|X n V" 2 l^iuj'J _ /7',Y n |X" V 2 l^iuj'J l^ Z 
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+ 



! II r n_un r i "^~2 



< 



2 »7,Y n | 



2™-H«x™ j || <r 2 



/7,Y"|X" (^ Fui 



U7,Y"|X™ \ Z \ X w,j) J'y',Y n \X n \ Z \ X w,j) l" z 

,) dz n + ^ 

n 

I^y^x™ \ z \ x w,j) ~ Jy,Y n \yL n \ z \ x w,j) \dz 
Note that from the triangular inequality, we have: 



„a "7',Y»| 

-.n un™n ^?*2 

* 7 iu,3 || ■*' 



/7',Y»|X« (^ ' X ' 



< 
< 



H n x n ■ 



IT™ T n 



n ™W 



Tjn Tin \ „n 



^ n - H™ x 



r w,3 



+ r'v 7 ^ 



(332) 
1 dz n 
(333) 

(334) 
(335) 
(336) 



The last step follows from ([89]) and ( 1901 



Therefore - 



H"x" 



1 w,3 



> r 2 implies: 

1 



r?. 



H /r n ■ 

- L - l 7 a uij 



> (r — r 



>\2 



for 



r > r 



This means that (13331) is upper bounded by: 



rlU n -H^a!^|| >r 2 



k\\z n -K-y> x Z,A\ >(r~r') 



+ 



~n TTn~ro ^^2 

"II* n 7 tt>,j|| ^' 



/7,Y"|X™ \ Z \ X w,j) dz 

J~i',~Y n \k. n \ z \ x w,j) ®z 

I^.Y^IX™ \ Z \ X w,j) ~ i7',Y™|X™ \ Z \ X w,j) \d>Z 



Hence, if r > r' and 



(r - r'f > N E (1 + e) 



then (13331) can be upper bounded by 11321 (B2)]: 

r> -na(e) , / If _ _ f^Lfl \ _ f _ - (V n l<r n "| |/7 r ™ 

' I u - ,,2 U7,Y"|X™ V 6 l x toj7 ^7',Y n X n ^ \ x w,j) \ U/i 

"'nil 2 "7*™^ || <r 

The second term in (13411) can be upper bounded by: 

l/7,Y n |X n \ Z \ X w,j) ~ Jy,Y n \X. n \ Z \ X w,j) V^ Z 



-H»x^.|| <r2 



(337) 



(338) 



(339) 



(340) 



(341) 



(342) 
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= /„ ,„ A,v. l x.(^l< J )|l- ^^'"\ ( t l ' X H l^" 0«) 



j"— Kjx2,j|| <r ■'7,Y n | 



Recall that when - 



~n "trn™n 



< r 2 , from (l3T9l)-d323l) we have 



f - . ( 7 n\ T n \ 
1 _ e ng(r,r>) < j _ ■V.Y'-IX" If \ X w,j) < j _ e _ n g(r,r') (344) 

Since g(r, r') > 0, we have 

-C / 71 \ 71 \ 

{1 _ /y,Yn|xn ^ I^J max{e n 9 (n,') _ X J _ e -n 9 (r,r>) } Q45) 

J-y,Y n \X. n V l J 'iu,jV 

Note that 1 — e~ x < 1 when x > 0. And there when < K 1 e 1 ' - 1 < 2x. Hence as long as 

ng(r,r')<l (346) 

we have (13431) upper bounded by: 

f a / 7j y«|*« (^KJ 2n^ (r, r') d*» (347) 

■'slk-H^sjll <^ 2 

<2n# (r, r') (348) 

Therefore as long as (I338I) . (I340I) and (13461) are satisfied, (13311) is upper bounded by: 

/ l/7,Y n |X™ \ Z \ X w,j) ~ Jj',Y n \X. n \ Z \ X w,j) \^ Z 

<2e~ na{£) + 2ng (r, r') (349) 

Applying this result to (13281) . we have 

2£)M«0 [ \f 7 ,Y«(z n ) ~ f 7 ,Y«\w(z n M\dz n (350) 

to ^ 

<4 e - nQ(e) + 4n# (r, r') 

+ 2^^H [ \f y , Y n(z n ) - f 7 , tY n ]w (z n \w)\dz n (351) 

to ^ 

and, we obtain (l96l) in Lemma [7] 

Since 7' G Sm> we can apply (f78l> -(|79 |) to 7', and bound (13511) by: 

4e" tta(£) + 4n# (r, r') + 12(2M + 1) 2N t n e e xp(-c'n) (352) 

Applying this result to (1324M325I) . we obtain <(97]> in Lemma 13 

It remains to check that (13381) . (13401) and (13461) are satisfied. This is guaranteed by the 
definitions of r and r' in (l90l) and ( |9T| ) and the condition ( [94b in the Lemma [7] Hence we 
have completed the proof of Lemma [71 
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Appendix G 
Proof of Lemma [TO] 

Consider two eavesdroppers, whose respective channel matrices are given below: 

H 7 = [I,0]Ui (353) 

H v = [I,0]U 2 (354) 

Let C\ be any codebook from the ensemble {C} described in Section IIV-CI Let C 2 be 

C 2 = U.U^Ci (355) 

= {U 2 U^V,x n eC 1 } (356) 

Define the probability density function of a codebook, /(C), as 

/(C) = n^K J ) (357) 

Since a unitary transform does not change the L 2 norm, we have 

f(Ci) = f(C 2 ) (358) 

We also observe from the maximum likelihood decoder (11661) . that the value of 7/ 7 for a given 
codebook C, r/ 7 (C), only depends on the set H 7 C, which is defined as: 

H 7 C = {H 7 x n : x n e C} (359) 

Since 

H 7 Ci = H y C 2 (360) 

We have 

r h (C x ) = r h ,(C 2 ) (361) 

Let U' = U 2 U^ 1 . Let C = XJ'C. Then we have 

r h = Jr h {C)f{C)dC (362) 

= f r]y (U'C) / (U'C) dC, (363) 

= Jvy(C')f(C')dC' (364) 

=?7y (365) 

Hence we have proved Lemma [TOl 



HE AND YENER, SUBMITTED TO IEEE TRANSACTIONS ON INFORMATION THEORY 



56 



Appendix H 
Proof of Lemma [H] 

Let Y, denote the part of Y" received during the 2th channel use. We begin by proving: 



^£[||Y t || 2 ] <nN E (P + l) 



4 = 1 



We have 



5>[iW 

4 = 1 












n 

^^[llH^ + N.II 2 

4 = 1 




n 

e^iiiw; 


+ E 


"llN.II 2 " 


+ 2Re 


E 



;h 7 x 4 )^n 4 



4=1 



(366) 

(367) 
(368) 
(369) 



Since N, is independent from X, ; and N, has mean and unit variance, we find that ( 1369b 
equals: 



L 7 Xj||" 



+ E 



4=1 

T4 

4=1 

n 

nN E + J2 E [l|H 7 Xi 



ic 11 2 



E 



IN: 



IN: 



2Re 



E 



(H 7 Xj 



i-H 



E 



N 



(370) 
(371) 
(372) 



4=1 



Let Hj be the jth row of H 7 . Then from (|36l , we have H^LL, = 1. Using this result, we find 
that (I372D equals: 



4=1 i=l 

71 N E 

--nN E + E E E [Xf Hf H^ 
»=i i=i 

^+E5>[i^i 2 " 
4=1 i=i 

=niy s + E ll x? 



-n. II 2 



(373) 
(374) 
(375) 
(376) 
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<nN E (1 + P) (377) 

The last step follows from the following fact 

-||X n || 2 <P, VX n eC (378) 

n 

Note that this is a stronger requirement than the average power constraint, in that it requires 
the power of each codeword not to exceed P. This is guaranteed by our codebook construction 
described in Section llV-Cl Lemma ITTI then follows by using the fact that the average power con- 
strained random vector achieves the largest differential entropy when it has Gaussian distribution 
with i.i.d. components lf3~7"l . 

Appendix I 
Proof of Lemma 

Let B io ^ x n be the set of values of Y n for which the decoder cp^ outputs x n given the label %q. 
Define ?7 7 |x n be the probability of decoding error for the eavesdropper indexed by 7 when the 
codeword x n is transmitted. Let B x n = B io>x n with i being the i label of x n . Let r 2 = 2N E . 
Then we have 



r ]l \x n = / f 1 (z n \x n )dz n (379) 

<[ _ A(^K)^+/|, ||2<nr , 2/7 (,"K)^ (380) 

J\\z ti. t z II >nr z"fB x n 

<e' na + L* xnl f <nr2 f,(z n \x n )dz" (381) 



Equation (I38TT) follows from [|32l (B2)]. Next, we apply (gU) and (f3T7T) - (f322T) to the second term 
of (I38TT) with r 2 = 2N E and (r') 2 = 2Nt ^ 2 eP and find that (I38TT) is upper bounded by 

e -na + e n 9{ rS) j^^^^ fy (^) cfo" (382) 

Z n $B x n 

<e~ na + e n9(r ' r ' } f / y (^ n |x n ) dz n (383) 

Therefore 

% < e~ na + e n9(r ' r,) r/ v (384) 

< e~ na + 5((2M + 1) 2N tN e + 1 j e -(B(*n)- fl (r,r')n (3g5) 

where the last step follows by applying (I173I ). This concludes the proof of Lemma [T2l 
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